CVE-2024-4577 PoC — PHP 操作系统命令注入漏洞

Source

https://github.com/ManuelKy08/CVE-2024-4577---RR

Associated Vulnerability

Title:PHP 操作系统命令注入漏洞 (CVE-2024-4577)
Description:PHP是一种在服务器端执行的脚本语言。 PHP存在操作系统命令注入漏洞，该漏洞源于在特定条件下，Windows系统使用“Best-Fit”行为替换命令行中的字符，这可能导致PHP CGI模块错误地将这些字符解释为PHP选项，从而泄露脚本的源代码，在服务器上运行任意PHP代码等。以下版本受到影响：8.1至8.1.29之前版本，8.3至8.3.8之前版本，8.2至8.2.20之前版本。

Readme

## PreView
<pre>

    ██╗  ██╗ ██████╗ ██╗  ██╗ ██████╗ ██╗  ██╗     ███████╗███████╗ ██████╗
    ██║ ██╔╝██╔═══██╗██║ ██╔╝██╔═══██╗██║ ██╔╝     ██╔════╝██╔════╝██╔════╝
    █████╔╝ ██║   ██║█████╔╝ ██║   ██║█████╔╝█████╗███████╗█████╗  ██║     
    ██╔═██╗ ██║   ██║██╔═██╗ ██║   ██║██╔═██╗╚════╝╚════██║██╔══╝  ██║     
    ██║  ██╗╚██████╔╝██║  ██╗╚██████╔╝██║  ██╗     ███████║███████╗╚██████╗
    ╚═╝  ╚═╝ ╚═════╝ ╚═╝  ╚═╝ ╚═════╝ ╚═╝  ╚═╝     ╚══════╝╚══════╝ ╚═════╝                                                                                           
     ====================================================================
     **                  Instagram : @risky.manuel                     **
     **                  Telegram  : @kikikokok9                       **
     **                  Email     : riskymanuel08@proton.me           **
     ====================================================================

# CVE-2024-4577
Argument injection vulnerability in PHP0

## INSTALL

git clone https://github.com/gotr00t0day/CVE-2024-4577.git

cd CVE-2024-4577

pip3 install -r requirements.txt --break-system-packages

# Scan A Target

python3 CVE-2024-4577.py -t https://160.153.61.66/ -c "<?phpphpinfo();?>"

# Scan a list of Targets

python3 CVE-2024-4577.py -f domains.txt -c  "<?phpphpinfo();?>"

Liat di website ini secara detail dan mendalam
https://nvd.nist.gov/vuln/detail/CVE-2024-4577

## Disclaimer
"Penggunaan tools ini sepenuhnya merupakan tanggung jawab pengguna. Saya tidak bertanggung jawab atas segala kerugian, kerusakan, atau konsekuensi yang mungkin timbul dari penggunaan yang tidak sesuai atau melanggar hukum. Pengguna diharapkan untuk mematuhi semua peraturan dan undang-undang yang berlaku."

File Snapshot


 [4.0K]  /data/pocs/b8cecfd8e3c3219959c0c12b00b029233b50e171
├── [2.0K]  CVE-2024-4577.py
├── [2.4K]  README.md
└── [  18]  requirements.txt

0 directories, 3 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!